Only interact with secretkeeper in updatable VMs
Change I893604ce5fc25d3e1c7261afa0de915902154be6 introduced a call to
secretkeeper to fetch its public key from v2 of the HAL (if available)
as opposed to from the device tree.
This is a problem for VMs that run on early boot, when secretkeeper is
not yet available.
Only attempt to access secretkeeper if an updatable VM is requested,
which should only happen in VMs that run when secretkeeper *is*
available.
Bug: 382376014
Test: atest CompOsDenialHostTest#denyDueToInconsistentFileName
Change-Id: I1c27ca5981500dc4ccaa0677ae61d0434b2d7653
diff --git a/android/virtmgr/src/aidl.rs b/android/virtmgr/src/aidl.rs
index 0f81f3d..e9074c6 100644
--- a/android/virtmgr/src/aidl.rs
+++ b/android/virtmgr/src/aidl.rs
@@ -889,34 +889,18 @@
.context("Failed to extract vendor hashtree digest")
.or_service_specific_exception(-1)?;
- let vendor_hashtree_digest = if let Some(ref vendor_hashtree_digest) = vendor_hashtree_digest {
+ let mut trusted_props = if let Some(ref vendor_hashtree_digest) = vendor_hashtree_digest {
info!(
"Passing vendor hashtree digest to pvmfw. This will be rejected if it doesn't \
match the trusted digest in the pvmfw config, causing the VM to fail to start."
);
- Some((cstr!("vendor_hashtree_descriptor_root_digest"), vendor_hashtree_digest.as_slice()))
+ vec![(cstr!("vendor_hashtree_descriptor_root_digest"), vendor_hashtree_digest.as_slice())]
} else {
- None
+ vec![]
};
- let key_material;
- let secretkeeper_public_key = if is_secretkeeper_supported() {
- let sk: Strong<dyn ISecretkeeper> = binder::wait_for_interface(SECRETKEEPER_IDENTIFIER)?;
- if sk.getInterfaceVersion()? >= 2 {
- let PublicKey { keyMaterial } = sk.getSecretkeeperIdentity()?;
- key_material = keyMaterial;
- Some((cstr!("secretkeeper_public_key"), key_material.as_slice()))
- } else {
- None
- }
- } else {
- None
- };
-
- let trusted_props: Vec<(&CStr, &[u8])> =
- vec![vendor_hashtree_digest, secretkeeper_public_key].into_iter().flatten().collect();
-
let instance_id;
+ let key_material;
let mut untrusted_props = Vec::with_capacity(2);
if cfg!(llpvm_changes) {
instance_id = extract_instance_id(config);
@@ -925,7 +909,14 @@
if want_updatable && is_secretkeeper_supported() {
// Let guest know that it can defer rollback protection to Secretkeeper by setting
// an empty property in untrusted node in DT. This enables Updatable VMs.
- untrusted_props.push((cstr!("defer-rollback-protection"), &[]))
+ untrusted_props.push((cstr!("defer-rollback-protection"), &[]));
+ let sk: Strong<dyn ISecretkeeper> =
+ binder::wait_for_interface(SECRETKEEPER_IDENTIFIER)?;
+ if sk.getInterfaceVersion()? >= 2 {
+ let PublicKey { keyMaterial } = sk.getSecretkeeperIdentity()?;
+ key_material = keyMaterial;
+ trusted_props.push((cstr!("secretkeeper_public_key"), key_material.as_slice()));
+ }
}
}